
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Node.js Module and CLI to generate Data URI scheme.
The data URI scheme is a uniform resource identifier (URI) scheme that provides a way to include data in-line in web pages as if they were external resources.
from: Wikipedia
npm install datauri
By default, datauri module returns a promise, which is resolved with data:uri string or rejected with read file error:
const datauri = require('datauri');
const content = await datauri('test/myfile.png');
console.log(content);
//=> "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..."
const datauri = require('datauri');
datauri('test/myfile.png', (err, content, meta) => {
if (err) {
throw err;
}
console.log(content); //=> "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..."
console.log(meta.mimetype); //=> "image/png"
console.log(meta.base64); //=> "iVBORw0KGgoAAAANSUhEUgAA..."
console.log(meta.buffer); //=> file buffer
});
const datauriCSS = require('datauri/css');
await datauriCSS('test/myfile.png');
//=> "\n.case {\n background-image: url('data:image/png; base64,iVBORw..."
await datauriCSS('test/myfile.png', {
className: 'myClass',
width: true,
height: true
});
//=> adds image width and height and custom class name
const Datauri = require('datauri/sync');
const meta = Datauri('test/myfile.png');
console.log(meta.content); //=> "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..."
console.log(meta.mimetype); //=> "image/png"
console.log(meta.base64); //=> "iVBORw0KGgoAAAANSUhEUgAA..."
console.log(meta.buffer); //=> file buffer
If you already have a file Buffer, that's the way to go:
const DatauriParser = require('datauri/parser');
const parser = new DatauriParser();
const buffer = fs.readFileSync('./hello');
parser.format('.png', buffer); //=> "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..."
const DatauriParser = require('datauri/parser');
const parser = new DatauriParser();
parser.format('.png', 'xkcd'); //=> "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..."
$ npm install
To run test specs
$ npm test
Node.js 10+
Node.js 8
npm install --save datauri@3
docs: https://github.com/data-uri/datauri/blob/v3.0.0/docs/datauri.md
Node.js 4+
npm install --save datauri@2
docs: https://github.com/data-uri/datauri/blob/v2.0.0/docs/datauri.md
MIT License
(c) Data-URI.js
(c) Helder Santana
The base64-img package allows you to convert images to base64 strings and vice versa. While it is more focused on image files, it provides similar functionality for converting files to Data URIs.
The file-base64 package is another alternative that focuses on converting files to base64 strings. It provides a simple API for encoding and decoding files, similar to datauri.
FAQs
Create DataURI scheme easily
The npm package datauri receives a total of 290,367 weekly downloads. As such, datauri popularity was classified as popular.
We found that datauri demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.